fix: nodemailer - email to an unintended domain can occur due to interpretation conflict. (#15356)

Resolves [Dependabot Alert
289](https://github.com/twentyhq/twenty/security/dependabot/289) and a
couple other alerts.

Removed types for `imapflow` since the package ships them internally
now. `yarn.lock` has major changes due to an upgraded AWS SDK
`@aws-sdk/client-sesv2` which is used by Nodemailer 7.

- No breaking changes were introduced in imapflow and mailparser. 
- Nodemailer's breaking change was dropping the legacy SES transport; we
already use the SMTP transport + our own AWS SES client, so nothing else
needs changing.
This commit is contained in:
Abdullah.
2025-10-26 07:08:13 +01:00
committed by GitHub
parent 7f911913c7
commit 63c261645a
5 changed files with 1034 additions and 86 deletions
@@ -37,7 +37,7 @@
"lodash.pickby": "^4.6.0",
"lodash.snakecase": "^4.1.1",
"lodash.upperfirst": "^4.3.1",
"nodemailer": "^6.9.14",
"nodemailer": "^7.0.10",
"sharp": "^0.33.5",
"uuid": "^10.0.0",
"winston": "^3.14.2"
@@ -2325,10 +2325,10 @@ __metadata:
languageName: node
linkType: hard
"nodemailer@npm:^6.9.14":
version: 6.9.14
resolution: "nodemailer@npm:6.9.14"
checksum: 10c0/2542986849bc6ec2bf12fb7b72226da0ce9c6a0946216dea020d9eedee3ac1a4eb2413f59772a3ddd4bb9188d5ce859167a030c065719473f71319e052a319dc
"nodemailer@npm:^7.0.10":
version: 7.0.10
resolution: "nodemailer@npm:7.0.10"
checksum: 10c0/9bb39bde904397879a6394e5202146167cabc3bd4089c1b0255ce16875e721d1cf132afde25a570fc4cf38f159ba6b6b5411d3b9371775543d38343fbd505101
languageName: node
linkType: hard
@@ -2682,7 +2682,7 @@ __metadata:
lodash.pickby: "npm:^4.6.0"
lodash.snakecase: "npm:^4.1.1"
lodash.upperfirst: "npm:^4.3.1"
nodemailer: "npm:^6.9.14"
nodemailer: "npm:^7.0.10"
sharp: "npm:^0.33.5"
uuid: "npm:^10.0.0"
winston: "npm:^3.14.2"